Examples with OAuthClient org.keycloak.testsuite.util.OAuthClient used on opensource projects

Example 31 with OAuthClient

use of org.keycloak.testsuite.util.OAuthClient in project keycloak by keycloak.

the class EntitlementAPITest method testObtainAllEntitlementsForScope.

@Test
public void testObtainAllEntitlementsForScope() throws Exception {
    ClientResource client = getClient(getRealm(), RESOURCE_SERVER_TEST);
    AuthorizationResource authorization = client.authorization();
    JSPolicyRepresentation policy = new JSPolicyRepresentation();
    policy.setName(KeycloakModelUtils.generateId());
    policy.setCode("$evaluation.grant();");
    authorization.policies().js().create(policy).close();
    Set<String> resourceIds = new HashSet<>();
    ResourceRepresentation resource = new ResourceRepresentation();
    resource.setName(KeycloakModelUtils.generateId());
    resource.addScope("sensors:view", "sensors:update", "sensors:delete");
    try (Response response = authorization.resources().create(resource)) {
        resourceIds.add(response.readEntity(ResourceRepresentation.class).getId());
    }
    resource = new ResourceRepresentation();
    resource.setName(KeycloakModelUtils.generateId());
    resource.addScope("sensors:view", "sensors:update");
    try (Response response = authorization.resources().create(resource)) {
        resourceIds.add(response.readEntity(ResourceRepresentation.class).getId());
    }
    ScopePermissionRepresentation permission = new ScopePermissionRepresentation();
    permission.setName(KeycloakModelUtils.generateId());
    permission.addScope("sensors:view", "sensors:update");
    permission.addPolicy(policy.getName());
    authorization.permissions().scope().create(permission).close();
    String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "kolo", "password").getAccessToken();
    AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
    AuthorizationRequest request = new AuthorizationRequest();
    request.addPermission(null, "sensors:view");
    AuthorizationResponse response = authzClient.authorization(accessToken).authorize(request);
    assertNotNull(response.getToken());
    Collection<Permission> permissions = toAccessToken(response.getToken()).getAuthorization().getPermissions();
    assertEquals(2, permissions.size());
    for (Permission grantedPermission : permissions) {
        assertTrue(resourceIds.containsAll(Arrays.asList(grantedPermission.getResourceId())));
        assertEquals(1, grantedPermission.getScopes().size());
        assertTrue(grantedPermission.getScopes().containsAll(Arrays.asList("sensors:view")));
    }
    request.addPermission(null, "sensors:view", "sensors:update");
    response = authzClient.authorization(accessToken).authorize(request);
    assertNotNull(response.getToken());
    permissions = toAccessToken(response.getToken()).getAuthorization().getPermissions();
    assertEquals(2, permissions.size());
    for (Permission grantedPermission : permissions) {
        assertTrue(resourceIds.containsAll(Arrays.asList(grantedPermission.getResourceId())));
        assertEquals(2, grantedPermission.getScopes().size());
        assertTrue(grantedPermission.getScopes().containsAll(Arrays.asList("sensors:view", "sensors:update")));
    }
    request.addPermission(null, "sensors:view", "sensors:update", "sensors:delete");
    response = authzClient.authorization(accessToken).authorize(request);
    assertNotNull(response.getToken());
    permissions = toAccessToken(response.getToken()).getAuthorization().getPermissions();
    assertEquals(2, permissions.size());
    for (Permission grantedPermission : permissions) {
        assertTrue(resourceIds.containsAll(Arrays.asList(grantedPermission.getResourceId())));
        assertEquals(2, grantedPermission.getScopes().size());
        assertTrue(grantedPermission.getScopes().containsAll(Arrays.asList("sensors:view", "sensors:update")));
    }
    request = new AuthorizationRequest();
    request.addPermission(null, "sensors:view");
    request.addPermission(null, "sensors:update");
    response = authzClient.authorization(accessToken).authorize(request);
    assertNotNull(response.getToken());
    permissions = toAccessToken(response.getToken()).getAuthorization().getPermissions();
    assertEquals(2, permissions.size());
    for (Permission grantedPermission : permissions) {
        assertTrue(resourceIds.containsAll(Arrays.asList(grantedPermission.getResourceId())));
        assertEquals(2, grantedPermission.getScopes().size());
        assertTrue(grantedPermission.getScopes().containsAll(Arrays.asList("sensors:view", "sensors:update")));
    }
}

Example 32 with OAuthClient

use of org.keycloak.testsuite.util.OAuthClient in project keycloak by keycloak.

the class EntitlementAPITest method testServerDecisionStrategy.

@Test
public void testServerDecisionStrategy() throws Exception {
    ClientResource client = getClient(getRealm(), RESOURCE_SERVER_TEST);
    AuthorizationResource authorization = client.authorization();
    ResourceRepresentation resource = new ResourceRepresentation();
    resource.setName(KeycloakModelUtils.generateId());
    resource.addScope("read", "write", "delete");
    try (Response response = authorization.resources().create(resource)) {
        resource = response.readEntity(ResourceRepresentation.class);
    }
    JSPolicyRepresentation grantPolicy = new JSPolicyRepresentation();
    grantPolicy.setName(KeycloakModelUtils.generateId());
    grantPolicy.setCode("$evaluation.grant();");
    authorization.policies().js().create(grantPolicy).close();
    JSPolicyRepresentation denyPolicy = new JSPolicyRepresentation();
    denyPolicy.setName(KeycloakModelUtils.generateId());
    denyPolicy.setCode("$evaluation.deny();");
    authorization.policies().js().create(denyPolicy).close();
    ResourcePermissionRepresentation resourcePermission = new ResourcePermissionRepresentation();
    resourcePermission.setName(KeycloakModelUtils.generateId());
    resourcePermission.addResource(resource.getId());
    resourcePermission.addPolicy(denyPolicy.getName());
    authorization.permissions().resource().create(resourcePermission).close();
    ScopePermissionRepresentation scopePermission1 = new ScopePermissionRepresentation();
    scopePermission1.setName(KeycloakModelUtils.generateId());
    scopePermission1.addScope("read");
    scopePermission1.addPolicy(grantPolicy.getName());
    ScopePermissionsResource scopePermissions = authorization.permissions().scope();
    scopePermissions.create(scopePermission1).close();
    String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "kolo", "password").getAccessToken();
    AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
    AuthorizationRequest request = new AuthorizationRequest();
    request.addPermission(resource.getName());
    try {
        authzClient.authorization(accessToken).authorize(request);
        fail("kolo can not access the resource");
    } catch (RuntimeException expected) {
        assertEquals(403, HttpResponseException.class.cast(expected.getCause()).getStatusCode());
        assertTrue(HttpResponseException.class.cast(expected.getCause()).toString().contains("access_denied"));
    }
    ResourceServerRepresentation settings = authorization.getSettings();
    settings.setDecisionStrategy(DecisionStrategy.AFFIRMATIVE);
    authorization.update(settings);
    assertPermissions(authzClient, accessToken, request, resource, "read");
    scopePermission1 = scopePermissions.findByName(scopePermission1.getName());
    scopePermission1.addScope("read", "delete");
    scopePermissions.findById(scopePermission1.getId()).update(scopePermission1);
    assertPermissions(authzClient, accessToken, request, resource, "read", "delete");
    ScopePermissionRepresentation scopePermission2 = new ScopePermissionRepresentation();
    scopePermission2.setName(KeycloakModelUtils.generateId());
    scopePermission2.addScope("write");
    scopePermission2.addPolicy(grantPolicy.getName());
    scopePermissions.create(scopePermission2).close();
    assertPermissions(authzClient, accessToken, request, resource, "read", "delete", "write");
    ScopePermissionRepresentation scopePermission3 = new ScopePermissionRepresentation();
    scopePermission3.setName(KeycloakModelUtils.generateId());
    scopePermission3.addResource(resource.getId());
    scopePermission3.addScope("write", "read", "delete");
    scopePermission3.addPolicy(grantPolicy.getName());
    scopePermissions.create(scopePermission3).close();
    assertPermissions(authzClient, accessToken, request, resource, "read", "delete", "write");
    scopePermission2 = scopePermissions.findByName(scopePermission2.getName());
    scopePermissions.findById(scopePermission2.getId()).remove();
    assertPermissions(authzClient, accessToken, request, resource, "read", "delete", "write");
    scopePermission1 = scopePermissions.findByName(scopePermission1.getName());
    scopePermissions.findById(scopePermission1.getId()).remove();
    assertPermissions(authzClient, accessToken, request, resource, "read", "delete", "write");
    scopePermission3 = scopePermissions.findByName(scopePermission3.getName());
    scopePermission3.addScope("write", "delete");
    scopePermissions.findById(scopePermission3.getId()).update(scopePermission3);
    assertPermissions(authzClient, accessToken, request, resource, "delete", "write");
    scopePermissions.findById(scopePermission3.getId()).remove();
    try {
        authzClient.authorization(accessToken).authorize(request);
        fail("kolo can not access the resource");
    } catch (RuntimeException expected) {
        assertEquals(403, HttpResponseException.class.cast(expected.getCause()).getStatusCode());
        assertTrue(HttpResponseException.class.cast(expected.getCause()).toString().contains("access_denied"));
    }
    ResourcePermissionRepresentation grantResourcePermission = new ResourcePermissionRepresentation();
    grantResourcePermission.setName(KeycloakModelUtils.generateId());
    grantResourcePermission.addResource(resource.getId());
    grantResourcePermission.addPolicy(grantPolicy.getName());
    authorization.permissions().resource().create(grantResourcePermission).close();
    assertPermissions(authzClient, accessToken, request, resource, "read", "delete", "write");
    settings.setDecisionStrategy(DecisionStrategy.UNANIMOUS);
    authorization.update(settings);
    try {
        authzClient.authorization(accessToken).authorize(request);
        fail("kolo can not access the resource");
    } catch (RuntimeException expected) {
        assertEquals(403, HttpResponseException.class.cast(expected.getCause()).getStatusCode());
        assertTrue(HttpResponseException.class.cast(expected.getCause()).toString().contains("access_denied"));
    }
}

Example 33 with OAuthClient

use of org.keycloak.testsuite.util.OAuthClient in project keycloak by keycloak.

the class EntitlementAPITest method testOfflineRequestingPartyToken.

@Test
public void testOfflineRequestingPartyToken() throws Exception {
    ClientResource client = getClient(getRealm(), RESOURCE_SERVER_TEST);
    AuthorizationResource authorization = client.authorization();
    JSPolicyRepresentation policy = new JSPolicyRepresentation();
    policy.setName(KeycloakModelUtils.generateId());
    policy.setCode("$evaluation.grant();");
    authorization.policies().js().create(policy).close();
    ResourceRepresentation resource = new ResourceRepresentation();
    resource.setName("Sensors");
    resource.addScope("sensors:view", "sensors:update", "sensors:delete");
    try (Response response = authorization.resources().create(resource)) {
        resource = response.readEntity(ResourceRepresentation.class);
    }
    ScopePermissionRepresentation permission = new ScopePermissionRepresentation();
    permission.setName("View Sensor");
    permission.addScope("sensors:view");
    permission.addPolicy(policy.getName());
    authorization.permissions().scope().create(permission).close();
    String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).scope("offline_access").doGrantAccessTokenRequest("secret", "offlineuser", "password").getAccessToken();
    AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
    AccessTokenResponse response = authzClient.authorization(accessToken).authorize();
    assertNotNull(response.getToken());
    controller.stop(suiteContext.getAuthServerInfo().getQualifier());
    controller.start(suiteContext.getAuthServerInfo().getQualifier());
    reconnectAdminClient();
    configureSectorIdentifierRedirectUris();
    TokenIntrospectionResponse introspectionResponse = authzClient.protection().introspectRequestingPartyToken(response.getToken());
    assertTrue(introspectionResponse.getActive());
    assertFalse(introspectionResponse.getPermissions().isEmpty());
    response = authzClient.authorization(accessToken).authorize();
    assertNotNull(response.getToken());
}

Example 34 with OAuthClient

use of org.keycloak.testsuite.util.OAuthClient in project keycloak by keycloak.

the class PermissionClaimTest method testPermissionWithClaimsDifferentPolicies.

@Test
public void testPermissionWithClaimsDifferentPolicies() throws Exception {
    ClientResource client = getClient(getRealm());
    AuthorizationResource authorization = client.authorization();
    ResourceRepresentation resource = new ResourceRepresentation("Resource B");
    authorization.resources().create(resource).close();
    ResourcePermissionRepresentation permission = new ResourcePermissionRepresentation();
    permission.setName(resource.getName() + " Permission");
    permission.addResource(resource.getName());
    permission.addPolicy(claimAPolicy.getName(), claimBPolicy.getName());
    authorization.permissions().resource().create(permission).close();
    PermissionRequest request = new PermissionRequest();
    request.setResourceId(resource.getName());
    String accessToken = new OAuthClient().realm("authz-test").clientId("test-client").doGrantAccessTokenRequest("secret", "marta", "password").getAccessToken();
    AuthzClient authzClient = getAuthzClient();
    String ticket = authzClient.protection().permission().forResource(request).getTicket();
    AuthorizationResponse response = authzClient.authorization(accessToken).authorize(new AuthorizationRequest(ticket));
    assertNotNull(response.getToken());
    AccessToken rpt = toAccessToken(response.getToken());
    Authorization authorizationClaim = rpt.getAuthorization();
    List<Permission> permissions = new ArrayList<>(authorizationClaim.getPermissions());
    assertEquals(1, permissions.size());
    Map<String, Set<String>> claims = permissions.get(0).getClaims();
    assertTrue(claims.containsKey("claim-a"));
    assertTrue(claims.containsKey("claim-b"));
}

Example 35 with OAuthClient

use of org.keycloak.testsuite.util.OAuthClient in project keycloak by keycloak.

the class PermissionClaimTest method testPermissionWithClaims.

@Test
public void testPermissionWithClaims() throws Exception {
    ClientResource client = getClient(getRealm());
    AuthorizationResource authorization = client.authorization();
    ResourceRepresentation resource = new ResourceRepresentation("Resource A");
    authorization.resources().create(resource).close();
    ResourcePermissionRepresentation permission = new ResourcePermissionRepresentation();
    permission.setName(resource.getName() + " Permission");
    permission.addResource(resource.getName());
    permission.addPolicy(claimAPolicy.getName());
    authorization.permissions().resource().create(permission).close();
    PermissionRequest request = new PermissionRequest();
    request.setResourceId(resource.getName());
    String accessToken = new OAuthClient().realm("authz-test").clientId("test-client").doGrantAccessTokenRequest("secret", "marta", "password").getAccessToken();
    AuthzClient authzClient = getAuthzClient();
    String ticket = authzClient.protection().permission().create(request).getTicket();
    AuthorizationResponse response = authzClient.authorization(accessToken).authorize(new AuthorizationRequest(ticket));
    assertNotNull(response.getToken());
    AccessToken rpt = toAccessToken(response.getToken());
    Authorization authorizationClaim = rpt.getAuthorization();
    List<Permission> permissions = new ArrayList<>(authorizationClaim.getPermissions());
    assertEquals(1, permissions.size());
    assertTrue(permissions.get(0).getClaims().get("claim-a").containsAll(Arrays.asList("claim-a", "claim-a1")));
}